Title: eBay Enhanced Picture Services ActiveX Control Remote Code Execution Vulnerability
Severity: HIGH
Description:
eBay Enhanced Picture Service ActiveX control is an application that allows a seller to upload pictures to an auction. The application is available for Microsoft Windows.
The eBay Enhanced Picture Services ActiveX control is prone to a remote code-execution vulnerability. This issue occurs because the control fails to sufficiently validate data passed to the 'PictureUrl()' method of the 'EPUWALcontrol.dll' ActiveX control. The ActiveX control can be identified by CLSIDs:
4C39376E-FA9D-4349-BACC-D305C1750EF3
C3EB1670-84E0-4EDA-B570-0B51AAE81679
Attackers may exploit this issue by enticing an unsuspecting victim to view a malicious webpage.
Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the affected application that uses the ActiveX control (typically Internet Explorer). Failed exploit attempts will result in a denial-of-service condition.
Affected Products:
- eBay Enhanced Picture Services ActiveX control
References:
- Microsoft: Microsoft Knowledge Base Article 240797
- US-CERT: Vulnerability Note VU#597721
- eBay: Vendor Homepage
- eBay: eBay Enhanced Picture Services ActiveX Control Update
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
